)]}'
{"keystone/assignment/controllers.py":[{"author":{"_account_id":220,"name":"Haneef Ali","email":"haneef.ali@hp.com","username":"haneef"},"change_message_id":"98708a921435f6a3e6eb1e336bf9f5fa0d5cc53e","unresolved":false,"context_lines":[{"line_number":774,"context_line":"            msg \u003d _(\u0027Specify a user or group, not both\u0027)"},{"line_number":775,"context_line":"            raise exception.ValidationError(msg)"},{"line_number":776,"context_line":""},{"line_number":777,"context_line":"    def _check_list_role_assignments(self, context):"},{"line_number":778,"context_line":"        project_id \u003d context[\u0027query_string\u0027].get(\u0027scope.project.id\u0027)"},{"line_number":779,"context_line":"        target \u003d {}"},{"line_number":780,"context_line":"        if project_id is not None:"}],"source_content_type":"text/x-python","patch_set":2,"id":"7a016987_bb8ed82b","line":777,"updated":"2015-05-21 22:02:25.000000000","message":"Can you please write a test?  I believe you are opening a flood gate.\n\nPlease check the following case?\n\nDomain A , -- Has project A\nDomain B  --  Has project B\n\nUsing domain scoped token for A,   filter for project Project B","commit_id":"6860f7eb317df4f69d85808e7da92ced72c1b632"},{"author":{"_account_id":16165,"name":"Chenhong Liu","email":"liuchenhong@unitedstack.com","username":"liuchenhong"},"change_message_id":"bcede5de7749a15a8661ac42bd004e0b0e4e5c0b","unresolved":false,"context_lines":[{"line_number":831,"context_line":"            formatted_refs \u003d self._expand_indirect_assignments(context,"},{"line_number":832,"context_line":"                                                               formatted_refs)"},{"line_number":833,"context_line":""},{"line_number":834,"context_line":"        if \u0027include_subtree\u0027 in params and params.get(\u0027scope.domain.id\u0027):"},{"line_number":835,"context_line":"            # NOTE(gyee): this means we need to return all the role"},{"line_number":836,"context_line":"            # assignments for the targets in the given domain. To do this,"},{"line_number":837,"context_line":"            # we need to add the \"hierarchy\" attribute in the ref, use it for"}],"source_content_type":"text/x-python","patch_set":4,"id":"5afe65bd_fb9ba9c7","line":834,"updated":"2015-06-03 08:25:26.000000000","message":"Does this patch related to this bug? The request still rejected inside the decorator.","commit_id":"f72e99fa9f5672c29c27b197e89f8e5d4d4afd9a"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"68e773c67e288c3a3870a2db9270113103023d1f","unresolved":false,"context_lines":[{"line_number":831,"context_line":"            formatted_refs \u003d self._expand_indirect_assignments(context,"},{"line_number":832,"context_line":"                                                               formatted_refs)"},{"line_number":833,"context_line":""},{"line_number":834,"context_line":"        if \u0027include_subtree\u0027 in params and params.get(\u0027scope.domain.id\u0027):"},{"line_number":835,"context_line":"            # NOTE(gyee): this means we need to return all the role"},{"line_number":836,"context_line":"            # assignments for the targets in the given domain. To do this,"},{"line_number":837,"context_line":"            # we need to add the \"hierarchy\" attribute in the ref, use it for"}],"source_content_type":"text/x-python","patch_set":4,"id":"5afe65bd_13c1b380","line":834,"in_reply_to":"5afe65bd_fb9ba9c7","updated":"2015-06-03 17:52:19.000000000","message":"did you do this as domain admin?\n\n  GET /v3/role_assignments?scope.domain.id\u003did\u0026include_subtree","commit_id":"f72e99fa9f5672c29c27b197e89f8e5d4d4afd9a"},{"author":{"_account_id":16165,"name":"Chenhong Liu","email":"liuchenhong@unitedstack.com","username":"liuchenhong"},"change_message_id":"c37adb45824848eb0abc87dbcf1007baa709dbc4","unresolved":false,"context_lines":[{"line_number":832,"context_line":"                                                               formatted_refs)"},{"line_number":833,"context_line":""},{"line_number":834,"context_line":"        if \u0027include_subtree\u0027 in params and params.get(\u0027scope.domain.id\u0027):"},{"line_number":835,"context_line":"            # NOTE(gyee): this means we need to return all the role"},{"line_number":836,"context_line":"            # assignments for the targets in the given domain. To do this,"},{"line_number":837,"context_line":"            # we need to add the \"hierarchy\" attribute in the ref, use it for"},{"line_number":838,"context_line":"            # athorization check, then strip it out. This is inefficient"}],"source_content_type":"text/x-python","patch_set":6,"id":"3afb71cf_ba0d6e39","line":835,"updated":"2015-06-05 02:14:34.000000000","message":"I am not sure about your plan to fix this bug, \n\nGET /v3/role_assignments?scope.project.id\u003dproject_id\n\nThis still failed with your patch.","commit_id":"db13da3274517dcd37a60141a1a6d7f53fc0d464"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"416dd70ddf64e9bdd621937cb2e7308ec2ad635d","unresolved":false,"context_lines":[{"line_number":832,"context_line":"                                                               formatted_refs)"},{"line_number":833,"context_line":""},{"line_number":834,"context_line":"        if \u0027include_subtree\u0027 in params and params.get(\u0027scope.domain.id\u0027):"},{"line_number":835,"context_line":"            # NOTE(gyee): this means we need to return all the role"},{"line_number":836,"context_line":"            # assignments for the targets in the given domain. To do this,"},{"line_number":837,"context_line":"            # we need to add the \"hierarchy\" attribute in the ref, use it for"},{"line_number":838,"context_line":"            # athorization check, then strip it out. This is inefficient"}],"source_content_type":"text/x-python","patch_set":6,"id":"3afb71cf_dd06cb1f","line":835,"in_reply_to":"3afb71cf_ba0d6e39","updated":"2015-06-05 16:46:42.000000000","message":"That one is pretty tough to address right now because authorization check was done prior to entering this code. Workaround is for domain admin to list all the role assignments in the subtree, cache the result locally, and then lookup project assignments in its local cache. Probably more efficient that way anyway. Role assignments are fairly static so my guess is that user experience won\u0027t be impacted that much with this approach.\n\nTo support domain admin lookup project assignment for a given project, we may have to overhaul the role assignment APIs. Perhaps something like,\n\nGET /v3/projects/id/role_assignments?include_subtree","commit_id":"db13da3274517dcd37a60141a1a6d7f53fc0d464"},{"author":{"_account_id":16165,"name":"Chenhong Liu","email":"liuchenhong@unitedstack.com","username":"liuchenhong"},"change_message_id":"fc4a7a6bcc3d0f268956e6e5fe645ab0e27718eb","unresolved":false,"context_lines":[{"line_number":832,"context_line":"                                                               formatted_refs)"},{"line_number":833,"context_line":""},{"line_number":834,"context_line":"        if \u0027include_subtree\u0027 in params and params.get(\u0027scope.domain.id\u0027):"},{"line_number":835,"context_line":"            # NOTE(gyee): this means we need to return all the role"},{"line_number":836,"context_line":"            # assignments for the targets in the given domain. To do this,"},{"line_number":837,"context_line":"            # we need to add the \"hierarchy\" attribute in the ref, use it for"},{"line_number":838,"context_line":"            # athorization check, then strip it out. This is inefficient"}],"source_content_type":"text/x-python","patch_set":6,"id":"3afb71cf_575ce524","line":835,"in_reply_to":"3afb71cf_dd06cb1f","updated":"2015-06-06 14:10:20.000000000","message":"I see. What do you think about Priti\u0027s patch which using a callback to add extra information to target?","commit_id":"db13da3274517dcd37a60141a1a6d7f53fc0d464"}],"keystone/common/controller.py":[{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"94d192907edc4f9e730413dba6c6d50d6f4d0754","unresolved":false,"context_lines":[{"line_number":196,"context_line":"                for key in kwargs:"},{"line_number":197,"context_line":"                    target[key] \u003d kwargs[key]"},{"line_number":198,"context_line":""},{"line_number":199,"context_line":"                if callback is not None:"},{"line_number":200,"context_line":"                    target[\u0027target\u0027] \u003d callback(self, context, **kwargs)"},{"line_number":201,"context_line":""},{"line_number":202,"context_line":"                self.policy_api.enforce(creds,"}],"source_content_type":"text/x-python","patch_set":2,"id":"5ad58531_dcba79c0","line":199,"updated":"2015-05-11 21:42:42.000000000","message":"I really like the idea of a callback! See if you can make it consistent with the get_member_from_driver() approach in line 120-125.","commit_id":"6860f7eb317df4f69d85808e7da92ced72c1b632"},{"author":{"_account_id":16165,"name":"Chenhong Liu","email":"liuchenhong@unitedstack.com","username":"liuchenhong"},"change_message_id":"29dbe072aebf87b6482267e25aeed31597b129f0","unresolved":false,"context_lines":[{"line_number":196,"context_line":"                for key in kwargs:"},{"line_number":197,"context_line":"                    target[key] \u003d kwargs[key]"},{"line_number":198,"context_line":""},{"line_number":199,"context_line":"                if callback is not None:"},{"line_number":200,"context_line":"                    target[\u0027target\u0027] \u003d callback(self, context, **kwargs)"},{"line_number":201,"context_line":""},{"line_number":202,"context_line":"                self.policy_api.enforce(creds,"}],"source_content_type":"text/x-python","patch_set":2,"id":"7a016987_9f527a12","line":199,"in_reply_to":"5ad58531_dcba79c0","updated":"2015-05-15 10:38:04.000000000","message":"I like the idea of callback, too! But this patch make the callback has inconsistent meaning with the callback of @protected. \n\nHow about this:\n\nchange arguments name: callback -\u003e target_callback\n\n# keep current logic to generate target\n\nif hasattr(self, \u0027get_member_from_driver\u0027) ...\n\nif callable(target_callback):\n    target.update(self, target, context, **kwargs)\n\n# call policy enforcer","commit_id":"6860f7eb317df4f69d85808e7da92ced72c1b632"}],"keystone/tests/unit/test_v3_assignment.py":[{"author":{"_account_id":16165,"name":"Chenhong Liu","email":"liuchenhong@unitedstack.com","username":"liuchenhong"},"change_message_id":"ff5b545e7c69bf2b631b3ccc9fdee06e630b1026","unresolved":false,"context_lines":[{"line_number":3312,"context_line":"        self.assertDictEqual(self.project3, self.expected_project)"},{"line_number":3313,"context_line":""},{"line_number":3314,"context_line":""},{"line_number":3315,"context_line":"class V3DomainAdminAssignmentTestCase(test_v3.RestfulTestCase):"},{"line_number":3316,"context_line":"    \"\"\"Test role assignment capabilities with domain admin.\"\"\""},{"line_number":3317,"context_line":""},{"line_number":3318,"context_line":"    def setUp(self):"}],"source_content_type":"text/x-python","patch_set":5,"id":"5afe65bd_7e84155d","line":3315,"updated":"2015-06-04 08:56:05.000000000","message":"You don\u0027t have to add this class here, you can find one in test_v3_protection.py, which has done setUp() and load_sample_data(), and I just expand it in https://review.openstack.org/#/c/187899/","commit_id":"cd6a3151a69e0515001fd23fb036d2cd86a01cc4"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"fb3573bc19de209a686e96bae7f342f70b5e7a7f","unresolved":false,"context_lines":[{"line_number":3312,"context_line":"        self.assertDictEqual(self.project3, self.expected_project)"},{"line_number":3313,"context_line":""},{"line_number":3314,"context_line":""},{"line_number":3315,"context_line":"class V3DomainAdminAssignmentTestCase(test_v3.RestfulTestCase):"},{"line_number":3316,"context_line":"    \"\"\"Test role assignment capabilities with domain admin.\"\"\""},{"line_number":3317,"context_line":""},{"line_number":3318,"context_line":"    def setUp(self):"}],"source_content_type":"text/x-python","patch_set":5,"id":"5afe65bd_b84f2f6a","line":3315,"in_reply_to":"5afe65bd_7e84155d","updated":"2015-06-04 16:23:48.000000000","message":"Excellent! Thanks for adding the tests. Can you please combine the tests here with you have?\n\n  1. add the response checks to your patch. i.e. self.assertValidRoleAssignmentListResponse, self.assertRoleAssignmentInListResponse, etc.\n  2. make 187899 a dependent of this patch\n\nI\u0027ll remove these tests in favor of yours.\n\nThanks!","commit_id":"cd6a3151a69e0515001fd23fb036d2cd86a01cc4"}]}